<!DOCTYPE html>
<html>

<head>
    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; img-src https://*; child-src 'none';">
</head>

<body>
    <form action="/submit" method="post">
        <textarea name="comment" rows="10" cols="30"></textarea><br />
        <input type="submit" value="submit" />
    </form>
</body>

</html>